IT security 2026-07-27

Level Tense — 72/100 — 2026-07-27

Tense day: 7 stories ranked, 2 of the top 7 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (87/100).

  1. Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability — 87/100 (CVE-2026-16812)
  2. Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability — 60/100 (CVE-2025-68686)
  3. CVE-2026-55971 — Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. — 36/100 (CVE-2026-55971)
  4. CVE-2026-45623 — PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into a… — 35/100 (CVE-2026-45623)
  5. CVE-2026-48144 — Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. — 35/100 (CVE-2026-48144)
  6. CVE-2026-58662 — Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bin… — 34/100 (CVE-2026-58662)
  7. CVE-2026-58023 — Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. — 27/100 (CVE-2026-58023)